FBI Tells Congress It Needs Hackers To Keep Up With Tech Company Encryption (buzzfeed.com) 103
An anonymous reader quotes a report from BuzzFeed: A high ranking technology official with the FBI told members of Congress Tuesday that the agency is incapable of cracking locked phones and devices on its own, even with additional resources. Amy Hess, the agency's executive assistant director for science and technology told a panel of the House Energy and Commerce Committee that encrypted communications continue to pose a challenge to the American law enforcement, and to the safety of the American public. But when asked by lawmakers to provide a practical solution beyond the FBI's talking points, she said that the cooperation of technology companies would be necessary. According to the New York Times, "The FBI defended its hiring of a third-party company to break into an iPhone used by a gunman in last year's San Bernardino, Calif., mass shooting, telling some lawmakers on Tuesday that it needed to join with partners in the rarefied world of for-profit hackers as technology companies increasingly resist their demands for consumer information." They are stressing the importance of cooperation with tech companies and "third parties" to help fight terrorism, claiming they do not have the capabilities and resources available to crack encrypted devices. Congress is currently debating potential legislation on encryption.
Dear FBI and US Gov (Score:5, Informative)
Re: (Score:2)
When hardware encryption fails, software encryption will just get stronger.
Now, I came to comment in this article, because I'm curious if there has been any information on what they found on the phone. Is there anything of interest, or are they just keeping silent about it, because they didn't find anything of note, as many had thought before they broke into it?
Their silence tells you everything you need to know.
Re: (Score:2)
Their silence tells you everything you need to know.
Really? Any idea how long it takes to chase down leads, especially if it connects to unfriendly places? How long did it take to hunt down Bin Laden, and did we get a play-by-play while it was going on? No, your premise that it tells you anything isn't logical.
Re: Dear FBI and US Gov (Score:4, Interesting)
Re: (Score:2)
Oh please, if the FBI had found anything even remotely useful they would be publicly beating Apple and lawmakers over the head with it. This whole saga is nothing more than a political wedge to extend their powers of search and seizure.
What he said.
Re: (Score:2)
So does, say, the news [cbsnews.com].
Not surprising, since they thoroughly destroyed everything with pertinent information on it. Why would they leave the iPhone untouched unless it was -- unsurprisingly -- used only for the purpose it was issued: work. This guy (or couple) was clearly exercising opsec, not even talking to their relatives about their feelings, let alone their plans, so it would have been more surprising if they had found anything on it.
Re:Dear FBI and US Gov (Score:5, Insightful)
Sure, the anarchists/communists/terrorists/boogyman may get away with something, but that's the cost of freedom. With liberty comes risk. And it's liberty which we've been guaranteed, not security against all comers.
Re:Dear FBI and US Gov (Score:5, Informative)
I think one of the bigger things hurting the FBI is they are so exclusive towards otherwise talented people compared to the private sector, and so their human resource pool leaves a lot to be desired. For example, even though polygraph is nothing more than an intimidation tactic that is basically useless, (and people who know it's a load of crap aren't intimidated by it) they won't hire anybody without subjecting them to it. They also exclude anybody who has at any point in their life consumed cannabis, which is in many ways more benign than alcohol.
On top of it all, they don't pay shit compared to private sector jobs. (In only my second year after graduation, I already make more than most FBI agents at GS12 by just doing datacenter work.)
We hackers are happy to help the good guys. Not FB (Score:5, Insightful)
I've worked in information security for a long time. I 've spoken with colleagues at various government agencies and learned that indeed they don't have a expertise far beyond what's available in the private sector; the movies are as fictional in that respect as they are in others. They do need assistance from the private side of the infosec community.
Fifteen years ago, I would have been happy to assist those who protect and serve if they were working on some actual crime, such as a murder case I was once contacted about. Since Snowden and other events, it's become quite clear that the federal government is not the good guys, for any definition of "good guys".
There's no single solution, but there is one thing that would really help. Prior to 9/11, international spy agencies such as the NSA were prohibited from sharing information with domestic police at agencies such as the FBI. The thinking was that the techniques and mindset used against our enemies, such as North Korea, shouldn't be used against our own citizens. After 9/11 it was determined (correctly) that the prohibition on cooperation made it more difficult to defend against attacks, so the rules were weakened or eliminated and cooperation between intelligence and law enforcement was encouraged. We need to put those walls back in place. Yes it will make defending against attacks more difficult, but it's worth it because the alternative turns out to be having the NSA and FBI attacking the citizens.
Re: (Score:2)
They went after the Quest CEO and put him in jail for 6 years after he refused to cooperate with the NSA.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
That's why one of the built-in security features is to accept password input only via the touchscreen, and only with escalating time delays after a few wrong guesses. Those are two of the features the government wanted Apple to bypass by writing a custom FBiOS.
Re: (Score:2)
Re: (Score:2)
We will keep making more sophisticated encryption. You will not beable to keep pace with our progress. We do not want you in our devices, fuck your laws.t
As one of the people who makes the crypto in the devices, I am delighted that the overreaching government actions have made it much easier for me to argue to do the right thing in terms of taking security seriously at all levels in our products and I assume this is the same in many companies. People have been claiming to do this for ever, but the apple-fbi thing really got engineers to think about it the right way.
Re: (Score:3)
well played........
Hackers? (Score:1)
What are we paying the NSA for?
Re: (Score:1)
Re: (Score:2)
The NSA is not into getting convictions and keeping the prisons full. The NSA is into getting information. They will never expose a source unless there is an extremely good reason from _their_ POV. Incidentally, that is why no state with an intact rule-of-law ever allows information from a secret agency to be used by law-enforcement.
Privacy in the past (Score:5, Insightful)
I find it strange that nobody seems to mention that law enforcement worked just fine in ancient history when private conversations were not recorded at all. The government could not get a transcript on demand because there was none. Likewise, the government still is unable to read our thoughts. Why should a thought be treated differently when it is expressed in speech or electronically through writing? Why should the government feel hamstrung by inability to read our encrypted written thoughs when it still can not read them while they reside in our heads? Should we not demand that both be treated as private without question and inaccessible to government extortion? Law enforcement has done just fine without reading our thoughs for centuries; it should do just fine in the future without reading our encrypted letters.
Re: (Score:2)
If there were thought reading devices (and I'm sure there will be one day), they'd want them to be used as well.
Re: (Score:2)
Re: (Score:2)
Hmm (Score:2)
After running Edward Snowden out of town (Score:5, Interesting)
Should it come to any surprise that the people they need don't want to work for the government? Or fled to Berlin to escape a similar fate?
If you keep backdooring encryption and ostracizing your own citizens who are strong on security, you can't expect to have any citizens who particularly want to help you out.
You can't just throw warm bodies at the problem like you can with traditional war. The Germans lost Einstein and countless other academic Jews to countries like the United States and Russia in WW2, and now the same thing is happening with security experts in the United States. Good luck with that.
Re: (Score:1)
Pretty much this.
The U.S. government has more-or-less shown their disdain for "hackers" - and Congress jokes about their distaste for "technology" every chance they get, with several of them often reminding people that they don't use email, etc. as if that's some kind of evil.
Technologically-inclined individuals are often treated with distrust and suspicion - especially if they're security researchers trying to show others how poorly their personal data is being handled.
Why would those in this sector give a
Re: (Score:2)
Very much this. In addition, you will find very few bright, capable and educated people that will want to work for the government in the first place. The government is where ideas, enthusiasm and individual freedom goes to die and they pay badly in addition. It is a valid way out for the mediocre that just want a master to serve, but that is it.
Re: (Score:1)
The irony of this is that due to US anti-hacking laws, those hackers are likely to increasingly come from overseas which could completely turns the NSA's dual directives on their head of foreign signals intelligence and domestic signals defense. They'll have to work with foreign hackers for domestic signals intelligence.
Re: (Score:2)
Indeed. One of the last steps in this process is prevent citizens from leaving the country by use of mine-fields, electric fences, etc. to limit the brain-drain. That has never worked well either.
Re: (Score:2)
It does not work in Sim City either. Of course I lacked mines and fencing and could only bulldoze the roads leading away.
Re: (Score:2)
What has my curiosity at the moment is this:
While the lawmakers made sure that the Government and various law enforcement agencies are exempt from the circumvention rules of the DMCA, I don't see where that would apply to the use of non-government or non-law enforcement talent. Being within the employ of the FBI itself, ( thus subject to US laws ) is one thing, resorting to non-US talent is quite another.
How can we hope to keep anything in check if our own government is going to utilize non-US talent to ci
incompatible (Score:2)
Re: (Score:2, Informative)
Most hackers would not compromise their ethics enough for the FBI
Re: (Score:1)
How can you insult the intelligence of hires with a "lie detector" test? I mean you walk in and they say, oh we want the best and brightest, now line up for your lie detector test. Really, does that work?
Re: (Score:2)
This will not end well (Score:2)
The FBI wants to grow the market-sector of black-hat hacking? (Yes, I know, but language evolves, so I use the 'press-accepted' term here.)
In what reality could this conceivably be a good idea? Tons of new "exploit-mining" companies would spring up. Many would then have the FBI as perhaps one of their clients.
We already saw this with Symantec in the 1980's giving away $50 for each 'new' or even 'variant' of a virus that someone 'discovered'. They helpfully provided examples – you know, for trainin
Re: (Score:2)
I missed mentioning that current US Law on 'cyber-security' would mean that most or all of these new companies would be based outside of the US, quite likely putting them beyond the reach of US Law (outside their contracts with the FBI), as long as they chose their country-of-incorporation and activity wisely.
Re: (Score:2)
As is often the case, Terry Pratchett had some wise/comic insights which are relevant.
"How Vetinari himself ascended to the Patricianship is a story yet untold. It is known that his advice was heeded by Snapcase's administration on at least one occasion: when a 20p bounty on rat tails was introduced to combat a serious rodent infestation, but threatened to drain the treasury dry without curtailing the rats' numbers. Vetinari's suggestion to "tax the rat farms" provided an early demonstration of his shrewd p
Re: (Score:2)
As is often the case, Terry Pratchett had some wise/comic insights which are relevant.
"How Vetinari himself ascended to the Patricianship is a story yet untold. Vetinari's suggestion to "tax the rat farms" provided an early demonstration of his shrewd political insight. "
Relevant and incisive quote indeed!
Re: (Score:2)
Re: (Score:2)
I think as soon as you start "hacking" for law enforcement the color of your hat changes. Isn't that the entire definition?
To what?
"Blue-hat" hacker?
Shall we coin a term right here, right now? (I do not advocate this idea.)
Re: (Score:2)
U-S-A! U-S-A!
And so (Score:2)
The FBI becomes indistinguishable from black hats.
Who else? (Score:2)
Who else are they going to turn to? All the honest, moral people gave them the finger.
Re: (Score:2)
Re: (Score:2)
They are breaking their own laws (Score:2)
By their own laws the people they seek to "help" them are not "hackers" but "crackers" who would normally pursued and locked up by that same FBI. Don't tehy have NSA assets to use? No, because even the NSA cannot blatantly circumvent what Congress has ruled over and over regarding mandatory back doors. No, they are looking for criminals because they are engaging in crime and in circumvention of he will of the people. They must be treated as law breakers.
Left Hand Right Hand (Score:2)
The US already have a bunch of very bright hackers on its payroll. They work down at Fort Meade in a big glass building with NSA written on the front of it.
What this smacks of, is kingdom building. The FBI is trying to bolster its own little playpen, instead of playing nicely with others and asking the NSA for help.
The FBI simply wants a bigger budget.
Take away the academy, weapons qualification, etc (Score:2)
Take away the academy, weapons qualification, etc parts and will let them get more people as well as older tech pro's who should not be cut out if they are.
older than 37 (right now only have an Veterans ones)
don't have the right degree (they can also add more wavers)
driver’s license (easy to get but there are people in areas where you don't need a car)
There should be non field desk job roll that even some in wheel chair can do tech stuff for the FBI.
Re: (Score:2)
Would that matter?
I'm surprised they can find anyone who would claim to be a Hacker to work with them.
Low pay.
Poor track record sticking to the letter of the law, let alone the spirit of the law.
Do illegal things and hide them behind national security.
To me it is no different than the scientists that won't work on weapons technology for the military.
We can't trust them to use that kind of power responsibly at any level (local, state, or federal law enforcement).
The proper checks and balances are just not th
Re: (Score:2)
There should be non field desk job roll that even some in wheel chair can do tech stuff for the FBI.
There probably are. There is law that lets people declared permanently disabled by the SSA –people on SSDI – "go to the front of the line". Effectively, from the bits I've read, anyone SSDI disabled, applying for a Federal Government job:
* Gets to skip the resume-culling steps that everyone else must pass through—They get to be considered in the last round.
* Is entitled to 'special considerations'. Not just wheelchair ramps, but flexible scheduling and si
Just say no (Score:2)
There is no right of the government to monitor communications. Before we had communications technology, it was all but impossible. The telegraph offered the first viable method for the government (and others) to spy on any and all communications, followed by the telephone, the cellphone, email, texts, etc. At each step, security was an afterthought, and so it provided a larger and larger attack surface. Governments (and others) have enjoyed the access that inattention has brought for too long. For so l
anti-intellectualism rolls downhill (Score:2)
And sloshes back up to The Hill. These Congressional leaders know what they know and don't listen to no scientists! The contempt and fear is palpable. When reality doesn't conform, they resort to threats, blame games and force.
So the FBI can't find talented people to help them with imaginary, badly conceived, and wrongheaded problems. I'm shocked, I tell you, shocked!
Re: (Score:2)
No, executive orders can be reversed at any time by the occupant of the White House. Nice try.
Re: (Score:2)
Ah, and in the last eight years, what had the Obama administration done to counter that? Fucking moronic AC.
Re: (Score:2)
Umm, no. The executive branch doesn't control the judicial.